CVE-2026-10589: CWE‑787: Out‑of‑Bounds Read/Write in Lenovo Yoga Pro 7 15IPH11 BIOS

This vulnerability involves an out-of-bounds write in the BIOS of Lenovo Yoga Pro 7 15IPH11, potentially enabling a local attacker with high privileges to execute arbitrary code within System Management Mode. The CVSS vector indicates low attack complexity, no user interaction, and high privileges required. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow code execution in System Management Mode, which operates at a high privilege level below the OS, potentially leading to full system compromise or persistent firmware-level control. However, exploitation requires local privileged access, limiting the attack surface.

Patch status is not yet confirmed — check the Lenovo vendor advisory for current remediation guidance. Until a patch is available, restrict local privileged access to trusted users only.